codex
Pass
Audited by Gen Agent Trust Hub on Oct 12, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided input through the
$ARGUMENTSvariable to generate a task prompt for the Codex CLI. - Ingestion points: User tasks and repository context are incorporated into the final prompt generated in SKILL.md.
- Boundary markers: The skill uses quoted shell heredocs (
<<'TASK') to prevent the shell from interpolating or executing any code contained within the user-provided task text. - Capability inventory: The skill executes the
codexCLI, which has the capability to read or modify the workspace depending on the requested mode. - Sanitization: Instructions explicitly warn the agent not to pass credentials or unrelated private material to the external tool.
- [COMMAND_EXECUTION]: The skill executes the
codexCLI tool. It appropriately uses sandboxing flags (--sandbox read-onlyfor reviews and--sandbox workspace-writefor authorized implementations) to enforce the principle of least privilege. - [EXTERNAL_DOWNLOADS]: The skill directs users to the official OpenAI developer documentation to install the required CLI tool, which is a well-known and trusted service.
Audit Metadata